The present invention is directed to the field of computer networks. It is more specifically directed to monitoring network performance metrics.
There is a growing demand for communication via networks. This is especially so, for networks that are based on the TCP/IP protocol. This is both within the context of a corporate intranet as well as the context of an ISP providing Internet services to a group of users. A typical network provider may connect different campus networks belonging to a customer via its backbone network. As a provider of network services, the provider is interested in monitoring and ensuring that the network performs according to the guidelines and limits specified in the service level agreement between itself and the customer. The need for monitoring may be felt by the network operator, the customer or both.
The network operator is typically interested in monitoring the performance of the network, which is in its domain of control. Thus, he would like to measure the performance between all the access points that a customer uses to connect to his network. One way to measure the performance would be to execute a traditional performance measurement tool on a pair of access points.
Current performance monitoring techniques involve the use of xe2x80x98pingxe2x80x99, xe2x80x98traceroutexe2x80x99, xe2x80x98netperfxe2x80x99, data accessed through SNMP, etc. These methods are disadvantageous in that they add extra traffic load in the network between all of the access points. These methods also add additional packet processing on the network routers. These traditional network performance measurement mechanisms tend to be relatively heavy weight and generally rely on sending a continuous sequence of ping packets or other network probes between an end-point to all the other end-points. This process creates a large increased load on the network. The traditional normally high overhead network performance measurement mechanisms are herein referred to as xe2x80x98heavy weightxe2x80x99 mechanisms.
A typical ISP or a corporate intranet backbone has a very large number of network end-points. It is not typical to have a continuous monitoring of network performance between all of the end-points. The problem is compounded by the fact that the access points that may be controlled by the network operator are usually intermediate points in the network, and do not constitute either the source or destination of the traffic.
Consider a network operator with N access points provided to a customer. These access points are intermediaries along the path that a packet takes from the customer network. Performance monitoring of the network operation requires monitoring the Nxc3x97(Nxe2x88x921) simplex channels between the pair-wise access points, and determining performance metrics such as delay between these access points. Another useful metric is the determination of the bandwidth that is being used between the different access points. The bandwidth usage is often a component in the price charged to the customer by the operator.
The measurement of bandwidth between the access points is difficult to do for an ISP. An IP packet only contains the final source and destination addresses, and standard routing information only provides the next outgoing interface from an ingress access router. Thus, determining the egress access router of a packet requires building a duplicate overlay routing infrastructure within the ingress access router. This introduces additional processing delays in the forwarding of an IP packet, and also requires additional space for storage of overlay routing information.
A different issue arises when performance metrics (e.g. delays) are being monitored between the access points. An ISP would like to proactively monitor the delays between two access points belonging to a customer to verify if the delays exceed the desired bounds. Using heavy weight probes to do this monitoring across all access points is not a viable solution due to the additional load generated on the network. However, a continuous monitoring of network performance is desirable to determine the level of service provided and/or to determine if there are any problems between two network access points.
It is therefore an aspect of the present invention to provide a low overhead method for monitoring bandwidth in a corporate intranet or an ISP controlled portion of the Internet.
It is also an aspect of the invention to provide a low overhead method for performance monitoring in a corporate intranet or an ISP controlled portion of the Internet.
It is a further aspect of the invention to provide a low overhead method for fault monitoring in a corporate intranet or an ISP controlled portion of the Internet.
It is a further aspect of the invention to provide apparatus, a computer product and an article of manufacture comprising a computer usable medium having computer readable program code means embodied therein for causing a computer to perform a low overhead method for a network which includes originating and receiving access routers. The method is such that bandwidth monitoring, performance monitoring and fault monitoring are all possible. In an example implementation of the invention, network probe packets are generated by copying normal outbound packets and modifying these packets such that the destination address remains in tact. Recipient nodes can identify probe packets by their protocol number and UDP header pattern. Probe packets that are sent to nodes that are not aware of the probe packet format, discard these packets through normal network mechanisms.
Still a further aspect of the present invention is an apparatus to monitor network performance characteristic between a first and a second access point in the network. The apparatus including: a trigger mechanism at the first access point for determining a time to generate a probe packet; a probe generation mechanism at the first access point for generating a probe packet based on contents of a data packet and probe generating criteria; a probe detection mechanism at the second access point for detecting the probe packet; and an analysis mechanism to compare the probe packet detected at the second access point to the probe packet generated at the first access point.
In an embodiment of the apparatus the trigger mechanism and probe generation mechanism are located in a path of forwarding packets and/or wherein the probe detection mechanism is located in the path of forwarding packets, and/or the probe detection mechanism performs the additional function of removing probe packets from a data stream, and/or the trigger mechanism and probe generation mechanism are located outside of the data forwarding path of the packets, and monitor the flow of packets through the first access point, and/or the probe detection mechanism is located outside of the data forwarding path of packets, and operates by monitoring the flow of packets through the second access point.
Still a further aspect of the present invention is a method for providing bandwidth measurement between an ingress and an egress access router in a network. The method including the steps of: counting a plurality of packets at the ingress access-router; generating a probe packet whenever a packet count reaches a specified value N; and counting the probe packets received at the egress access-router.
In a particular embodiment of the method the step of discarding the probe packets through normal network mechanisms if an egress edge device is not found at a specified destination address of the probe packet, and/or the step of generating includes probe packets copying every Nth packet and changing the source address of the Nth packet to that of an originating access router; changing the protocol number to a reserved protocol number, attaching a UDP header with a reserved pattern, and attaching a data segment as the UDP payload which includes a probe number and a local time-stamp, and/or the step of the egress access-router identifying probe packets by the reserved protocol number and the UDP header pattern, and/or a delay between two endpoints can be determined through use of a common clock and probe packets, and/or the step of counting a first number of probe packets received, and comparing the first number to a second number of packets that should have been received.
Still a further aspect of the present invention is a method for providing bandwidth accounting between a first and a second ISP access point in a network. The method including: configuring at least one ingress access point to have a first packet count of xe2x80x98N-inxe2x80x99; the at least one ingress access point keeping track of a second packet count xe2x80x98N-outxe2x80x99 of packets sent into the network; and generating a probe packet whenever xe2x80x98N-outxe2x80x99=xe2x80x98N-inxe2x80x99, wherein the probe packets being given a destination address of an Nth packet sent into the network, and being given a source address of an ingress router associated with the at least one ingress point.
Still a further aspect of the present invention is a method for measuring network characteristics between a first and a second router in a network. The method including the steps of: configuring at least one ingress access point on the first router to generate a plurality of probe packets; generating each of the probe packets based on the contents of a next data packet passing through the ingress access point; configuring at least one egress access point on the second router to detect the probe packet; and correlating each of the probe packets received at the egress access point with each of the probe packets sent by the ingress access point to determine the network characteristics between the ingress and egress access points. In some cases the probe packets are generated after a preset number of data packets have passed through the ingress access point.
Still a further aspect of the present invention is to provide an article of manufacture comprising a computer usable medium having computer readable program code means embodied therein for determining network characteristics between a first and a second access point in a network. The computer readable program code means in the article of manufacture comprising computer readable program code means for causing a computer to effect the steps of configuring the first access point as an ingress access point to generate a plurality of probe packets; generating each of the probe packets based on contents of a data packet and preset criteria; configuring the second access point as an egress access point to detect the probe packets; and correlating each of the probe packets received at the egress access point with one of the probe packets sent by the ingress access point to determine the network characteristics between the two access points. In some cases the network characteristics include a round-trip delay between two endpoints and the step of generating includes marking the probe packet with a time of generation, and the computer readable program code means in the article of manufacture further comprising computer readable program code means for causing a computer to effect the steps of the egress access point reflecting a probe packet back to the ingress access point; and the ingress access point comparing the time of generation to a time when the probe was received back.
Still a further aspect of the present invention is to provide a computer program product comprising a computer usable medium having computer readable program code means embodied therein for forming a plurality of probes packets in an network. The computer readable program code means in the computer program product comprising computer readable program code means for causing a computer to effect: marking a protocol field in an header of each probe packet with a reserved protocol number; filling a source port field in a UDP header for each probe packet with the reserved pattern; and filling a destination probe field with the probe number.
In a particular embodiment of the computer program product, the computer readable program code means in the computer program product further comprising the step of using the reserved protocol number at an egress access router to identify each probe packet, and/or the computer readable program code means in the computer program product further comprising the step of extracting each probe packet based on an identification obtained in the step of using.